0

I am developing a custom shellcode encoder in C++. It takes shellcode as a command line argument and generates encoded shellcode (unsigned char array) and the instructions to decode it (C/C++ code). I then use the output of my encoder into a C process injection template for Windows. With the original shellcode being an msfvenom windows/x64/shell_reverse_tcp payload and Windows defender turned off, everything works fine (program completes without errors, I get a reverse shell). But with defender on, the decoded shellcode in memory is detected as a "meterpreter" payload right after the decode routine completes. What is the correct way to handle the decoded shellcode in memory to avoid detection? I've tried storing the decoded shellcode in an unsigned char array defined on the stack, heap as well as writing each decoded byte with WriteProcessMemory(hProcess, shellcodeAddr+i, &decoded_byte, 1, NULL); using a loop.

1
  • 1
    Welcome to the community. It's because the signature for the assembly used by MSF is being detected Commented Aug 29, 2023 at 16:57

0

You must log in to answer this question.

Browse other questions tagged .